Skip to content

Class 6 – Human Security

Cybersecurity Culture and Human-Centric Security Report

Part 1: Cyber Resilience vs. Protection

What is Cyber Resilience?

Cyber resilience is the ability of an organization to prepare for, respond to, recover from, and continue operating after a cyber incident.

Traditional security focuses mainly on protection by preventing attackers from entering a system. However, cyber resilience assumes that security breaches may still happen and focuses on minimizing damage and restoring normal operations.

a. One Way to Build Cyber Resilience

One effective way to build resilience is through:

Tabletop Exercises

These exercises simulate cybersecurity incidents and allow employees to practice their roles during emergencies. They help organizations identify weaknesses in response plans and improve coordination.

b. Challenges to Building Cyber Resilience

Some factors that prevent organizations from becoming resilient include:

  • Misallocation of resources – Organizations may spend most resources on prevention while giving less attention to response and recovery.
  • Security awareness fatigue – Employees may become less responsive due to constant exposure to cybersecurity warnings.

c. Why Cyber Resilience Helps with Human Vulnerabilities

Humans are often the weakest link in cybersecurity due to mistakes such as:

  • Clicking phishing links
  • Using weak passwords
  • Sharing sensitive information accidentally

Since technology cannot prevent every human error, cyber resilience provides backup plans to reduce the impact of mistakes.

Part 2: Cybersecurity Culture

What is Cybersecurity Culture?

Cybersecurity culture refers to the values, attitudes, and beliefs that influence how people behave toward security in an organization.

A strong security culture ensures that cybersecurity becomes everyone’s responsibility, not only the IT department’s responsibility.

a. Behaviors of a Secure Organization

Examples of secure behaviors include:

1. Reporting Suspicious Activities

Employees should immediately report:

  • Phishing emails
  • Suspicious links
  • Security incidents

This follows the principle:

See something, say something

2. Using Security Tools Properly

Employees should consistently use:

  • Password managers
  • Multi-factor authentication
  • Security updates

3. Verifying AI Output

Employees should review and verify information generated by AI before using it in professional work.

b. Values, Attitudes, and Beliefs Behind These Behaviors

These behaviors are supported by the belief that:

“Cybersecurity is everyone’s responsibility.”

Important values include:

  • Individual accountability
  • Awareness
  • Responsibility
  • Continuous learning

Employees should understand that their actions directly affect organizational security.

c. Ways to Build Cybersecurity Values

Organizations can create security culture through:

Leadership Support

  • Leaders should regularly discuss cybersecurity.
  • Meetings can include short cybersecurity awareness discussions.

Reward Systems

Positive behaviors can be encouraged by:

  • Recognizing employees who report threats.
  • Giving appreciation or rewards for good security practices.

Clear Consequences

Organizations should have clear policies for repeated security violations, including:

  • Additional training
  • Warnings
  • Corrective actions

Part 3: Human-Centric GenAI Security Concerns

Generative AI introduces new security risks because users may trust AI outputs too much or share sensitive information without understanding the consequences.

Concern 1: AI Hallucination and Inaccurate Information

Why It Is a Concern

People may over-trust AI-generated responses even when the information is incorrect.

AI can produce convincing but false information, which may lead to poor decisions.

Example

An employee uses GenAI to analyze a dataset and presents the generated insights to a client without checking the accuracy. The AI had created incorrect statistics.

Behavior to Reduce Risk

Users should:

  • Verify AI-generated information.
  • Cross-check important outputs with reliable sources.
  • Apply human judgment before making decisions.

Security Mechanism

Organizations should encourage:

Management Participation

Leaders should demonstrate responsible AI usage by questioning and verifying AI-generated results.

Concern 2: Data Leakage and Privacy Risks

Why It Is a Concern

Employees may accidentally enter confidential or sensitive information into public AI tools.

This can expose:

  • Personal information
  • Company data
  • Customer information
  • Proprietary documents

Example

A user uploads a confidential document to an AI tool for editing without realizing that sensitive information may be exposed.

Behavior to Reduce Risk

Users should:

  • Remove sensitive information before using AI tools.
  • Avoid entering confidential data into public AI systems.
  • Use approved organizational AI tools.

Security Mechanism

Organizations should implement:

Acceptable Use Policies

These policies should define:

  • Approved AI tools
  • Allowed usage
  • Restricted information
  • Data handling procedures

Conclusion

This exercise demonstrated that cybersecurity is not only a technical issue but also a human responsibility.

Strong cybersecurity requires:

  • Cyber resilience planning
  • Positive security culture
  • Responsible use of AI technologies

By combining technology, policies, and human awareness, organizations can reduce cybersecurity risks and respond effectively when incidents occur.